# Spectrum card: OutSystems Agent Workbench

> GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray Spectrum beta card of OutSystems Agent Workbench: A4 · R3 · C2 · O2, Scaling; 61 provisions lit across 8 instruments.
> Page: https://gamma-ray.sgit.ai/spectrum/cards/outsystems-agent-workbench/ · Source: data/scans/outsystems-agent-workbench.json


Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

Builds, runs and governs AI agents (agentic apps) on OutSystems Developer Cloud (ODC): agents call server actions, MCP tools and external A2A agents, with guardrails, evaluations, traces and workflow human-in-the-loop steps.

OutSystems Agent Workbench a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A4 Autonomy Orchestrates with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 R3 Reach Open protocol with options on · as shipped R2 π Moderate · S1·R5·A1 ×3 C2 Control Configurable with options on · as shipped C1 π Moderate · S1·R5·A1 ×3 O2 Openness Documented π Moderate · S1·R5·A1 ×3 Draft Stage: Scaling (11 of 16) In production Open protocol Standout. Autonomy 4 (Orchestrates): "Agents orchestrate workflows across platforms while maintaining security and governance." Next unlock. Openness 3 (Measured): public evidence that test or evaluation results are published would get there. Trust. FACT-Ray : 22 facts: 22 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 61 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 12 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

*Figure. The walk from the card down to each indicator, its public source and the instruments it touches; the sections below list the same in text.*

## What each level rests on

*Figure. For each dimension, what its level rests on: one fold-out per fact, each opening that fact's path down to the source.*

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by [published rules](../../evidence-map/index.md). A dimension with no evidence reads "not yet evidenced".

## Autonomy: level 4, Orchestrates

*What does the agent do on its own?* Runs multi-step workflows across systems or coordinates other agents; a person sets goals and reviews outcomes. **This level holds with: Hitl workflow; Agent workflow; A2a connection.** As shipped, with nothing turned on, it is not yet evidenced.

- `I10` It works across several domains or systems. The product FAQ says agents connect to APIs, databases, ERP, CRM and legacy systems and orchestrate workflows across platforms. "Agents orchestrate workflows across platforms while maintaining security and governance." [Source](https://www.outsystems.com/platform/agentic-ai-workbench) (read, documented, captured 2026-11-10T15:46Z, sha256 `b8d83b34ccd1be37`) · π Moderate · S1·R5·A1 ×3
- `I12` Several agents coordinate inside the organisation. Workflows chain several agents, each with its own lifecycle, passing one agent's output to the next. "With this pattern, you can chain multiple agents together sequentially." [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (read, documented, available, captured 2026-11-10T15:46Z, sha256 `409bddbad33512f9`) · π Moderate · S1·R5·A1 ×3
- `I13` Agents operate across organisational boundaries or disparate stacks. Agentic apps can delegate tasks to external agents, outside ODC, over the A2A protocol. "allows your ODC agentic apps to interact and collaborate with external agents" [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) (read, documented, available, captured 2026-11-10T15:46Z, sha256 `7bc6c8084a21d0cf`) · π Moderate · S1·R5·A1 ×3
- `I18` The agent works independently; the person approves critical decisions only. In a workflow, agents run as automatic activities completed without human intervention, and a Human activity assigned to a user or role pauses the workflow until that person approves or rejects the agent's output. "allowing the workflow to resume based on the human's decision" [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (read, documented, available, captured 2026-11-10T15:46Z, sha256 `409bddbad33512f9`) · π Moderate · S1·R5·A1 ×3

This evidence touches 14 provisions: Salesforce, Microsoft, OWASP, AAGMM, EAAMM.

## Reach: level 3, Open protocol

*How connected is it?* A published agent interface with documented authorisation. **This level holds with: MCP connection; A2a connection.** As shipped, with nothing turned on, it is level 2, Integrated.

- `I14` There is a published protocol or communication layer between agents. The A2A connector implements version 0.3.0 of the published Agent2Agent protocol, reading the remote agent card. "ODC A2A connector supports only A2A 0.3.0 protocol version" [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=8764e4f7-25f3-4a21-b6a9-000c59f4a93a) (read, documented, available, captured 2026-11-10T15:46Z, sha256 `305b5bf8b523b55b`) · π Moderate · S1·R5·A1 ×3
- `I25` It asks for narrower access than the whole account. The builder grants each agent a set of server actions it may call; with none granted, the agent relies only on the AI model's knowledge. "You provide the agent with a set of available actions." [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (read, documented, captured 2026-11-10T15:46Z, sha256 `b9307656fbaee2ea`) · π Moderate · S1·R5·A1 ×3

This evidence touches 8 provisions: Salesforce, AAGMM, MCP authorization.

**Next unlock: level 4, Ecosystem.** Public evidence that others build on it: third parties publish integrations, skills or agents for it.

## Control: level 2, Configurable

*Can people stay in command?* Approval modes, permission scopes and roles are documented settings. **This level holds with: Hitl workflow.** As shipped, with nothing turned on, it is level 1, Stated.

- `I38` High-impact actions need a person's approval. The human-in-the-loop pattern stops at a high-stakes trigger until a person verifies or decides. "alerts a human user to provide verification or a decision before proceeding" [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (read, documented, available, captured 2026-11-10T15:46Z, sha256 `ad4921b706fb6cc0`) · π Moderate · S1·R5·A1 ×3
- `I25` It asks for narrower access than the whole account. The builder grants each agent a set of server actions it may call; with none granted, the agent relies only on the AI model's knowledge. "You provide the agent with a set of available actions." [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (read, documented, captured 2026-11-10T15:46Z, sha256 `b9307656fbaee2ea`) · π Moderate · S1·R5·A1 ×3

This evidence touches 11 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft, MCP authorization.

**Next unlock: level 3, Observable.** Public evidence that its actions are logged; and that it is monitored in operation.

## Openness: level 2, Documented

*Does it show its work?* Public documents on how it works, its data, its models and its limits.

- `I22` Its limits and known failure cases are documented for those who use it. The guardrails page documents where guardrails do not apply: files, some languages in basic-coverage regions, and two unsupported regions. "Prompts or responses in other languages can bypass safety filters." [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (read, documented, captured 2026-11-10T15:46Z, sha256 `adaf537c0b182a67`) · π Moderate · S1·R5·A1 ×3
- `I58` The data it uses is described. The docs describe agent grounding data: internal aggregates, search services and external tools. "Sources can include internal aggregates, search services (RAG), or external tools." [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (read, documented, captured 2026-11-10T15:46Z, sha256 `4bebd8d78dce8555`) · π Moderate · S1·R5·A1 ×3
- `I61` The models and third-party components it uses are listed. The docs list the supported model providers (OpenAI, Anthropic, Azure OpenAI, Amazon Bedrock, Gemini and others) and the trial models. "ODC supports connections to AI models from multiple providers" [Source](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=af45db6e-ac0f-4ab9-8e4a-4ba8fd559812) (read, documented, captured 2026-11-10T15:46Z, sha256 `0727bf95007ca798`) · π Moderate · S1·R5·A1 ×3

This evidence touches 9 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce, OWASP.

**Next unlock: level 3, Measured.** Public evidence that test or evaluation results are published.

## How far to trust this card

**Status: Draft.** Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. [FACT-Ray](../../../fact-ray/index.md) says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.

- **The facts:** 22 facts: 22 π Moderate. Each is written beside its evidence above.
- **The chain:** found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
- **Who:** produced by `gamma.studio@web-summit.dinis`; checked by `gamma.review@web-summit.dinis` and `gamma.approve@web-summit.dinis`. [The actors](../../../fact-ray/actors/index.md).
- **What would raise it:** the company's own file at `/.well-known/fact-ray.json` (Source 2), a customer's statement of use (Source 3), or a named person signing the card ([how](../../../fact-ray/well-known/index.md)).

## The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

| Instrument | Provisions touched | Of those publicly readable |
|---|---|---|
| Salesforce | 17 | 24 |
| EAAMM | 4 | 8 |
| OWASP | 11 | 18 |
| MCP authorization | 4 | 8 |
| AAGMM | 4 | 6 |
| Microsoft | 7 | 23 |
| NIST AI RMF | 12 | 20 |
| EU AI Act | 2 | 6 |

The 61 provisions lit

Each line item, with the facts that reach it. "Evidenced" is a link of the kind *same*: the fact is what the provision asks. "Partly" is a link of the kind *part*: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.

| Provision | Instrument | Reached by | How far |
|---|---|---|---|
| [`sf.a04`](../../../provisions/sf.a04/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I58](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a06`](../../../provisions/sf.a06/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [S1](https://www.outsystems.com/case-studies/teamwork-ai-agents/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a07`](../../../provisions/sf.a07/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I08](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a08`](../../../provisions/sf.a08/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I58](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.L2`](../../../provisions/sf.L2/index.md) Level 2: Simple Orchestration, Single Domain | Salesforce | [I08](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a13`](../../../provisions/sf.a13/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I12](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a14`](../../../provisions/sf.a14/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I25](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a15`](../../../provisions/sf.a15/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I14](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=8764e4f7-25f3-4a21-b6a9-000c59f4a93a) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a16`](../../../provisions/sf.a16/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I10](https://www.outsystems.com/platform/agentic-ai-workbench) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.L3`](../../../provisions/sf.L3/index.md) Level 3: Complex Orchestration, Multiple Domain | Salesforce | [I10](https://www.outsystems.com/platform/agentic-ai-workbench) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a17`](../../../provisions/sf.a17/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I10](https://www.outsystems.com/platform/agentic-ai-workbench) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a18`](../../../provisions/sf.a18/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I14](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=8764e4f7-25f3-4a21-b6a9-000c59f4a93a) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a20`](../../../provisions/sf.a20/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I13](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a21`](../../../provisions/sf.a21/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I25](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a22`](../../../provisions/sf.a22/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I38](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.L4`](../../../provisions/sf.L4/index.md) Level 4: Multi-Agent Orchestration | Salesforce | [I13](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a25`](../../../provisions/sf.a25/index.md) Level 4, how to maximize value | Salesforce | [I13](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.L3`](../../../provisions/eaamm.L3/index.md) L3 Consultative (survey item Q9) | EAAMM | [I17](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.L4`](../../../provisions/eaamm.L4/index.md) L4 Supervisory (survey item Q9) | EAAMM | [I18](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.D2`](../../../provisions/eaamm.D2/index.md) Readiness dimension 2 | EAAMM | [I58](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.G2`](../../../provisions/eaamm.G2/index.md) Prerequisite, L2 to L3 | EAAMM | [I40](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT3`](../../../provisions/owasp.AT3/index.md) AT3 Citizen Developer Agent | OWASP | [I03](https://www.outsystems.com/platform/agentic-ai-workbench) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT6`](../../../provisions/owasp.AT6/index.md) AT6 Externally Extended Agent | OWASP | [I11](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=7a08a9ca-8a6e-4f48-9079-8f840ce01a7b) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT7`](../../../provisions/owasp.AT7/index.md) AT7 Multi-Agent Orchestration | OWASP | [I12](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT8`](../../../provisions/owasp.AT8/index.md) AT8 Federated / Cross Boundary | OWASP | [I13](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=6c449182-a1d4-4584-9558-5292f761f97a) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k04`](../../../provisions/owasp.k04/index.md) Maturity Level 0 Unaware and Ad Hoc, key enterprise action | OWASP | [I47](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k07`](../../../provisions/owasp.k07/index.md) Maturity Level 1 Experimentation without Guardrails, key enterprise action | OWASP | [I21](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k12`](../../../provisions/owasp.k12/index.md) Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action | OWASP | [I38](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k14`](../../../provisions/owasp.k14/index.md) Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action | OWASP | [I61](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=af45db6e-ac0f-4ab9-8e4a-4ba8fd559812) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k18`](../../../provisions/owasp.k18/index.md) Maturity Level 3 Integrated, Continuous Oversight, key enterprise action | OWASP | [I39](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k19`](../../../provisions/owasp.k19/index.md) Maturity Level 3 Integrated, Continuous Oversight, key enterprise action | OWASP | [I48](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.k22`](../../../provisions/owasp.k22/index.md) Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action | OWASP | [I48](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.01`](../../../provisions/mcp.01/index.md) Authorization (draft) | MCP authorization | [S3](https://www.outsystems.com/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.02`](../../../provisions/mcp.02/index.md) Authorization (draft) | MCP authorization | [S3](https://www.outsystems.com/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.06`](../../../provisions/mcp.06/index.md) Authorization (draft) | MCP authorization | [I25](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`mcp.15`](../../../provisions/mcp.15/index.md) Authorization (draft) | MCP authorization | [I25](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-02`](../../../provisions/aagmm.GD-02/index.md) GD-02 | AAGMM | [I25](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-05`](../../../provisions/aagmm.GD-05/index.md) GD-05 | AAGMM | [I58](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=24d5a0ea-68c8-4851-b7de-e0908c122862) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-06`](../../../provisions/aagmm.GD-06/index.md) GD-06 | AAGMM | [I38](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (partly), [I40](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-09`](../../../provisions/aagmm.GD-09/index.md) GD-09 | AAGMM | [I12](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (partly), [I14](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=8764e4f7-25f3-4a21-b6a9-000c59f4a93a) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.200.2.1`](../../../provisions/ms.200.2.1/index.md) 200: Repeatable, Business strategy | Microsoft | [I08](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.200.4.2`](../../../provisions/ms.200.4.2/index.md) 200: Repeatable, Technology and data | Microsoft | [I10](https://www.outsystems.com/platform/agentic-ai-workbench) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.300.2.3`](../../../provisions/ms.300.2.3/index.md) 300: Defined, Business strategy | Microsoft | [I21](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly), [I38](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.2.1`](../../../provisions/ms.400.2.1/index.md) 400: Capable, Business strategy | Microsoft | [I10](https://www.outsystems.com/platform/agentic-ai-workbench) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.2.3`](../../../provisions/ms.400.2.3/index.md) 400: Capable, Business strategy | Microsoft | [S1](https://www.outsystems.com/case-studies/teamwork-ai-agents/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.500.3.3`](../../../provisions/ms.500.3.3/index.md) 500: Efficient, AI governance and security | Microsoft | [I48](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.500.4.1`](../../../provisions/ms.500.4.1/index.md) 500: Efficient, Technology and data | Microsoft | [I12](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-3.2`](../../../provisions/nist.GOVERN-3.2/index.md) GOVERN 3.2 | NIST AI RMF | [I40](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-6.1`](../../../provisions/nist.GOVERN-6.1/index.md) GOVERN 6.1 | NIST AI RMF | [I11](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=7a08a9ca-8a6e-4f48-9079-8f840ce01a7b) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MANAGE-2.4`](../../../provisions/nist.MANAGE-2.4/index.md) MANAGE 2.4 | NIST AI RMF | [I39](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.1`](../../../provisions/nist.MAP-1.1/index.md) MAP 1.1 | NIST AI RMF | [I20](https://www.outsystems.com/platform/agentic-ai-workbench) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.3`](../../../provisions/nist.MAP-1.3/index.md) MAP 1.3 | NIST AI RMF | [I20](https://www.outsystems.com/platform/agentic-ai-workbench) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.4`](../../../provisions/nist.MAP-1.4/index.md) MAP 1.4 | NIST AI RMF | [S1](https://www.outsystems.com/case-studies/teamwork-ai-agents/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-2.1`](../../../provisions/nist.MAP-2.1/index.md) MAP 2.1 | NIST AI RMF | [I20](https://www.outsystems.com/platform/agentic-ai-workbench) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-2.2`](../../../provisions/nist.MAP-2.2/index.md) MAP 2.2 | NIST AI RMF | [I22](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (evidenced), [I21](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=aec0cd3b-dcd4-4077-b0c0-04e987bdb690) (partly) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-3.3`](../../../provisions/nist.MAP-3.3/index.md) MAP 3.3 | NIST AI RMF | [I20](https://www.outsystems.com/platform/agentic-ai-workbench) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-3.5`](../../../provisions/nist.MAP-3.5/index.md) MAP 3.5 | NIST AI RMF | [I38](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-4.1`](../../../provisions/nist.MAP-4.1/index.md) MAP 4.1 | NIST AI RMF | [I11](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=7a08a9ca-8a6e-4f48-9079-8f840ce01a7b) (partly), [I61](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=af45db6e-ac0f-4ab9-8e4a-4ba8fd559812) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MEASURE-2.5`](../../../provisions/nist.MEASURE-2.5/index.md) MEASURE 2.5 | NIST AI RMF | [I22](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-13`](../../../provisions/aiact.art-13/index.md) Article 13 | EU AI Act | [I20](https://www.outsystems.com/platform/agentic-ai-workbench) (partly), [I22](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=673835c6-c109-4aa2-a3b5-507ab4da8611) (partly), [S3](https://www.outsystems.com/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-14`](../../../provisions/aiact.art-14/index.md) Article 14 | EU AI Act | [I38](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=5332e43d-bd1c-4403-8f46-5cbdaf198318) (partly), [I39](https://extranetprdintegrations.outsystems.net/Documentation_API/rest/getContentMarkdown/doc?Guid=2d97c9e1-6bd4-48ef-8efc-66b75069eb5f) (partly) | partly · π Moderate · S1·R5·A1 ×3 |

## Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's [GAMMA-Ray rating](../../../scans/outsystems-agent-workbench/index.md): freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

## The vault

Every source behind this card was captured and hashed into a public sgit vault (`ivinvfhj`): `captures.json` lists each URL with the SHA-256 of what was fetched and when. Read key:

`sgit_public_read_a787d5ebd3b7fca03039c35a5d95311a66cc5581cbc41eec0ad3ab0c46272feb:ivinvfhj`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_a787d5ebd3b7fca03039c35a5d95311a66cc5581cbc41eec0ad3ab0c46272feb:ivinvfhj`.